4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30913

CVE-2026-30913: flarum/nickname: Display name injection in notification emails (autolink & markdown)

Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30913

CVE-2026-30913:

4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flarum/nicknames	composer	< 1.8.3	1.8.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because user-provided nicknames were not properly sanitized before being included in notification emails, allowing for two types of link injection. The analysis of the patch commit 4dde99729abdce8f6e2a7437c86e38735fdcca28 reveals two key areas of modification that directly address the vulnerability.

Output Sanitization (NicknameDriver.php): The primary vulnerable function is Flarum\Nicknames\NicknameDriver::displayName. Before the patch, this function directly returned the stored nickname. This function is called when Flarum needs to display a user's name, including when constructing emails. An attacker could set their nickname to a value like [Click Me](https://evil.com) or malicious.com. When an email notification involving this user was sent, the displayName function would return this malicious string, which would then be rendered as a clickable link by the recipient's email client. The patch fixes this by adding sanitization directly within the displayName function to strip markdown characters and break domain auto-linking.
Input Validation (AddNicknameValidation.php): The second function, Flarum\Nicknames\AddNicknameValidation::__invoke, contributes to the vulnerability by failing to prevent malicious nicknames from being saved in the first place. The patch adds a validation rule to this function to reject nicknames containing characters like []()<>, providing a defense-in-depth mechanism by blocking malicious input before it is stored.

Therefore, during exploitation, the Flarum\Nicknames\NicknameDriver::displayName function would be the one appearing in a runtime profile as it processes the malicious nickname to be included in the email. The AddNicknameValidation::__invoke function is involved when the attacker sets their nickname.

Vulnerable functions

Flarum\Nicknames\NicknameDriver::displayName

src/NicknameDriver.php

This function was vulnerable because it returned the user's nickname or username without any sanitization. This raw string was then used in plain-text notification emails. Email clients would automatically interpret certain strings (like 'example.com' or markdown links) as clickable hyperlinks, leading to a phishing vulnerability. The patch mitigates this by stripping characters used in markdown links and inserting a zero-width space after dots to prevent autolinking.

Flarum\Nicknames\AddNicknameValidation::__invoke

src/AddNicknameValidation.php

This function is responsible for validating a user's nickname before it is saved. Prior to the patch, it did not validate for characters that could be used to construct markdown links (e.g., '[]()<>'). This allowed users to save malicious nicknames that would later be rendered as links in emails by the `NicknameDriver::displayName` function. The patch adds a new validation rule to reject these characters at the input stage.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.